Loading story…
Russian-linked TA488—also tracked as Void Blizzard or Laundry Bear—has reportedly exploited CVE-2026-42897, a high-severity stored cross-site scripting flaw (CVSS 8.1) in on-premises Microsoft Exchange Server Outlook Web Access. A crafted HTML email triggers attacker-controlled JavaScript when opened in an authenticated OWA session, without requiring an additional click, deploying the fileless browser-resident OWAReaper implant. Exchange Online and Microsoft 365 are reportedly not affected.
OWAReaper can enumerate and collect mailbox data, steal browser autofill credentials and Exchange Web Services OAuth tokens, execute encrypted modules, and establish persistence by granting the built-in Default mailbox user Owner permissions. It stores components in browser LocalStorage, IndexedDB, and Outlook cache, uses GitHub Commit Search for command retrieval, and exfiltrates through HTTPS traffic relayed via image CDNs and DNS tunneling. Organizations using affected on-premises Exchange versions should apply the available updates, revoke potentially exposed tokens, audit mailbox permissions, and clear browser storage to remove residual implant persistence.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
Resecurity published an analysis describing alleged TA488 exploitation of the high-severity stored-XSS flaw CVE-2026-42897 in on-premises Exchange OWA. The report detailed the browser-resident OWAReaper implant, including mailbox-permission persistence, OAuth-token theft, and C2/exfiltration mechanisms.
July Exchange security updates addressed CVE-2026-42897, including KB5103212 for Exchange Server Subscription Edition RTM and KB5103215 for Exchange Server 2016 CU23; Exchange Server 2019 CU14/CU15 required ESU Period 2 updates.
Microsoft released temporary mitigations for the OWA vulnerability, including the EM Service rule M2.1.0 and the EOMT script. The measures require manual rollback after patching to prevent OWA issues.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourceresecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed **CVE-2026-42897**, a cross-site scripting flaw in on-premises **Exchange Server** Outlook Web Access (**OWA**), affecting Exchange Server 2016, 2019, and Subscription Edition. The bug can be triggered by a specially crafted email and may execute arbitrary JavaScript when a user opens the message in OWA under certain interaction conditions. Microsoft said **Exchange Online is not affected** and pushed an automatic mitigation through the **Exchange Emergency Mitigation Service** as mitigation ID `M2.1.x`, while also providing a scripted workaround for disconnected environments through the Exchange on-premises Mitigation Tool. Proofpoint reported that Russia-aligned **TA488** exploited the flaw in a 22 July campaign targeting U.S. and European government organizations as well as telecommunications, financial, hospitality, and aerospace entities. The operation used "half-click" emails to deliver **OWAReaper**, a previously unknown JavaScript implant that runs entirely inside the OWA browser context, steals credentials and tokens, and maintains persistence across browser restarts, credential changes, and even device reimaging; it also used GitHub commit messages and attacker-controlled emails for command-and-control, with data exfiltration over HTTPS and fallback DNS tunneling. Proofpoint assessed that infrastructure timing suggests the actor may have used `CVE-2026-42897` as a zero-day before Microsoft's out-of-band fix.
Aug 11, 2026
Researchers identified **OWASSRF**, an in-the-wild exploit chain targeting on-premises Microsoft Exchange Server through Outlook Web Access (OWA). The technique combines `CVE-2022-41080` and `CVE-2022-41082` to obtain remote code execution and bypasses URL-rewrite mitigations deployed against the earlier ProxyNotShell exploitation path involving `CVE-2022-41040` and `CVE-2022-41082`. The Play ransomware group was observed using OWASSRF against organizations, with victims concentrated in Latin America and particularly Brazil. Exchange Server 2013, 2016, and 2019 installations that remain unpatched are affected; Microsoft’s `KB5019758` security update, or a later update, remediates the exposure. Organizations unable to patch immediately should disable OWA and limit Remote PowerShell and externally accessible Exchange services.
Sep 3, 2026
Microsoft released fixes for **CVE-2026-42897**, a high-severity spoofing flaw in **Exchange Server** that was actively exploited in attacks and could lead to arbitrary JavaScript execution through cross-site scripting in **Outlook Web Access (OWA)**. The vulnerability affects **Exchange Server 2016**, **Exchange Server 2019**, and **Exchange Server Subscription Edition**, and can be triggered remotely without privileges by sending a specially crafted email that executes when opened in OWA under certain user-interaction conditions. Microsoft classifies the issue as a spoofing vulnerability, consistent with prior MSHTML- and web-rendering-related spoofing flaws such as **CVE-2024-43461**. Before full patches were released, Microsoft deployed an automatic temporary mitigation through the **Exchange Emergency Mitigation Service** in mid-May and later shipped permanent fixes in its June 2026 security updates, while advising administrators to keep mitigations enabled and patch immediately. **CISA** added the bug to its **Known Exploited Vulnerabilities** catalog on May 15 and ordered U.S. federal agencies to remediate affected systems by May 29, underscoring continued attacker focus on Exchange, which has seen numerous exploited flaws over the past five years, including several linked to ransomware activity.
Jun 29, 2026